seshlock 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6cfcb3d813ef94aa1c1f92cb16f2a4957c97333a80f93db7743b5be737807a6
-  data.tar.gz: 91c4999ee8be9ccb65c2e4fdba90a2db94eeaedcb443e5e47804fc8eb55cf867
+  metadata.gz: fbf274a0b946e63b4705ff7c2fe438217c107cc65303f3e68af2f815d4e66b88
+  data.tar.gz: 301a0d5e8cbd576b149a69b99907d4d212ab0999e91e9b6c73278d7382f235c1
 SHA512:
-  metadata.gz: 94416fa5470e6684db3943fd053a6f89b907087bb44722b8a620a1f944d48ed0027e08a6e43ae39939f91a4bbbf709a64204aeda6601bad43bc98181ee515d07
-  data.tar.gz: d076424c00799b4e8d862ea252754bbf238c3d0e18a38206db60f96044e363529dd8b465b8a1b3d05d47832d4d607a9368a0f8eea8563ff0e88ab5073c497e6c
+  metadata.gz: da7ef58b5f72b5c39212117d800b286426ba1a2dd6b5ae62261d309f6dfca28c23839165714554590271f046315d297c7e14c5eefd434194e7bd049695b629f1
+  data.tar.gz: f6d2fadcdc3ed13121dcee13bfec93d4ec0f36d479b06648b8c0495f995befaf36f909d10f4ac53be180d541fb3acbc262d791ffcd80a78bf2a8e5615ea1aa86

data/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-01-13
+
+### Added
+
+- **Session Listing**: `user.seshlock_sessions` returns all active sessions for a user, ordered by most recent first.
+- **Revoke All Sessions**: `user.revoke_all_seshlock_sessions!` revokes all active sessions for a user (logout everywhere).
+- **Revoke Other Sessions**: `user.revoke_other_seshlock_sessions!(except_refresh_token:)` revokes all sessions except the specified one.
+- **Controller Helpers**:
+  - `seshlock_list_sessions` - Returns array of session info with `id`, `device`, `created_at`, `expires_at`, and `current` flag.
+  - `seshlock_revoke_all` - Revokes all sessions for the current user.
+  - `seshlock_revoke_others` - Revokes all sessions except the current one.
+  - `seshlock_revoke_session(session_id:)` - Revokes a specific session by ID.
+
 ## [0.1.2] - 2025-12-11
 
 ### Fixed

data/README.md

@@ -160,6 +160,50 @@ The `Seshlock::UserMethods` concern adds:
 user.seshlock_refresh_tokens  # => has_many association
 user.seshlock_access_tokens   # => has_many through refresh_tokens
 user.issue_seshlock_session(device: nil)  # => TokenPair
+
+# Session Management
+user.seshlock_sessions                    # => Active sessions (most recent first)
+user.revoke_all_seshlock_sessions!        # => Logout everywhere
+user.revoke_other_seshlock_sessions!(except_refresh_token: token)  # => Logout other devices
+```
+
+### Controller Session Management
+
+List, revoke specific, or revoke multiple sessions:
+
+```ruby
+class SessionsController < ApplicationController
+  include Seshlock::ControllerMethods
+
+  before_action :authenticate_with_seshlock_access_token!, 
+                only: [:index, :destroy, :destroy_others]
+  before_action :authenticate_with_seshlock_refresh_token!, 
+                only: [:destroy_all]
+
+  # GET /sessions - List all active sessions
+  def index
+    render json: { sessions: seshlock_list_sessions }
+    # Returns: [{ id: 1, device: "iPhone", created_at: ..., expires_at: ..., current: true }, ...]
+  end
+
+  # DELETE /sessions/:id - Revoke specific session
+  def destroy
+    seshlock_revoke_session(session_id: params[:id])
+    head :ok
+  end
+
+  # DELETE /sessions/others - Revoke all except current
+  def destroy_others
+    seshlock_revoke_others
+    head :ok
+  end
+
+  # DELETE /sessions/all - Revoke all (requires refresh token)
+  def destroy_all
+    seshlock_revoke_all
+    head :ok
+  end
+end
 ```
 
 ## Error Handling

data/lib/seshlock/access_token.rb

@@ -8,6 +8,7 @@ class Seshlock::AccessToken < ActiveRecord::Base
 
   # Associations
   belongs_to :refresh_token, class_name: "Seshlock::RefreshToken", inverse_of: :access_tokens
+  has_one :user, through: :refresh_token
 
   # Scopes
   scope :not_expired, -> { where("expires_at > ?", Time.current) }

data/lib/seshlock/controller_methods.rb

@@ -153,6 +153,60 @@ module Seshlock
       build_token_response(user: user, token_pair: token_pair)
     end
 
+    # -------------------------------------------------------------------------
+    # Session Management Helpers
+    # -------------------------------------------------------------------------
+
+    # Lists all active sessions for the current user.
+    #
+    # Call authenticate_with_seshlock_access_token! before this method.
+    #
+    # @return [Array<Hash>] session info for each active refresh token
+    def seshlock_list_sessions
+      @current_seshlock_user.seshlock_sessions.map do |refresh_token|
+        {
+          id: refresh_token.id,
+          device: refresh_token.device_identifier,
+          created_at: refresh_token.created_at,
+          expires_at: refresh_token.expires_at,
+          current: refresh_token.id == @current_seshlock_access_token&.refresh_token_id
+        }
+      end
+    end
+
+    # Revokes all sessions for the current user.
+    #
+    # Call authenticate_with_seshlock_refresh_token! before this method.
+    # This will log the user out of all devices including the current one.
+    #
+    # @return [void]
+    def seshlock_revoke_all
+      @current_seshlock_refresh_token.user.revoke_all_seshlock_sessions!
+    end
+
+    # Revokes all sessions except the current one.
+    #
+    # Call authenticate_with_seshlock_access_token! before this method.
+    #
+    # @return [void]
+    def seshlock_revoke_others
+      @current_seshlock_user.revoke_other_seshlock_sessions!(
+        except_refresh_token: @current_seshlock_access_token.refresh_token
+      )
+    end
+
+    # Revokes a specific session by ID.
+    #
+    # Call authenticate_with_seshlock_access_token! before this method.
+    #
+    # @param session_id [Integer] the refresh token ID to revoke
+    # @return [void]
+    # @raise [ActiveRecord::RecordNotFound] if session doesn't belong to user
+    def seshlock_revoke_session(session_id:)
+      refresh_token = @current_seshlock_user.seshlock_refresh_tokens.find(session_id)
+      refresh_token.revoke!
+    end
+
     private
 
     # Extracts the raw refresh token from params.

data/lib/seshlock/user_methods.rb

@@ -18,9 +18,37 @@ module Seshlock
                 through: :seshlock_refresh_tokens
     end
 
-    # Convenience helper
+    # Issue a new session for this user.
+    #
+    # @param device [String, nil] optional device identifier
+    # @return [Seshlock::TokenPair] the issued token pair
     def issue_seshlock_session(device: nil)
       Seshlock::Sessions.issue_tokens_to(user: self, device: device)
     end
+
+    # List all active sessions for this user.
+    #
+    # @return [ActiveRecord::Relation<Seshlock::RefreshToken>] active refresh tokens
+    def seshlock_sessions
+      seshlock_refresh_tokens.active.order(created_at: :desc)
+    end
+
+    # Revoke all sessions for this user.
+    #
+    # @return [void]
+    def revoke_all_seshlock_sessions!
+      seshlock_refresh_tokens.active.find_each(&:revoke!)
+    end
+
+    # Revoke all sessions except the specified one.
+    #
+    # @param except_refresh_token [Seshlock::RefreshToken] the session to keep active
+    # @return [void]
+    def revoke_other_seshlock_sessions!(except_refresh_token:)
+      seshlock_refresh_tokens
+        .active
+        .where.not(id: except_refresh_token.id)
+        .find_each(&:revoke!)
+    end
   end
 end

data/lib/seshlock/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Seshlock
-  VERSION = "0.1.2"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: seshlock
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Daniel Inoa
@@ -67,7 +67,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Session tokens (access + refresh) for Rails apps.
 test_files: []